CVE-2011-1093

Impact:
Important
Public Date:
2011-03-02
IAVA:
2012-A-0020
Bugzilla:
682954: CVE-2011-1093 kernel: dccp: fix oops on Reset after close

The MITRE CVE dictionary describes this issue as:

The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.

Find out more about CVE-2011-1093 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not include support for the DCCP protocol. Future updates in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG may address this flaw.

CVSS v2 metrics

Base Score 7.8
Base Metrics AV:N/AC:L/Au:N/C:N/I:N/A:C
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 5 (kernel) RHSA-2011:0833 2011-05-31
Red Hat Enterprise Linux 6 (kernel) RHSA-2011:0498 2011-05-10
MRG Grid for RHEL 5 Server (kernel-rt) RHSA-2011:0500 2011-05-10

Mitigation

For users that do not run applications that use DCCP, you can prevent the dccp
module from being loaded by adding the following entry to the end of the
/etc/modprobe.d/blacklist file:

blacklist dccp

This way, the dccp module cannot be loaded accidentally, which may occur if an
application that requires DCCP is started. A reboot is not necessary for this
change to take effect but do make sure the module is not loaded in the first
place. You can verify that by running:

lsmod | grep dccp

You may also consider removing the CAP_SYS_MODULE capability from the current
global capability set to prevent kernel modules from being loaded or unloaded.
The CAP_SYS_MODULE has a capability number of 16 (see linux/capability.h). The
default value has all the bits set. To remove this capability, you have to
clear the 16th bit of the default 32-bit value, e.g. 0xffffff ^ (1 << 16):

echo 0xFFFEFFFF > /proc/sys/kernel/cap-bound

Last Modified

CVE description copyright © 2017, The MITRE Corporation